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For: Security Association Updates In a 
Packet Load-Balanced System 

Arguments to Accompany the Pre- Appeal Brief Request for Review 



Applicants hereby submit the following Arguments, in five (5) or less total pages, 
as attachment to the Pre-Appeal Brief Request for Review Form (PTO/SB/33). A Notice 
of Appeal is concurrently filed. 



Applicants' arguments in the Amendment and Reply under 37 C.F.R. §1.111 filed 
on April 27, 2007 (hereinafter "Reply"), were not properly considered or responded to by 
the Examiner in the final Office Action mailed July 25, 2007 (hereinafter the "Final 
Office Action"). In the Final Office Action, independent claims 1,14, 28, and 39 were 
rejected under 35 U.S.C. § 102(e) as being allegedly anticipated by Noehring, et al, U.S. 
Patent Publication 20020188839 (Noehring). The Examiner's response was legally and 
factually deficient because the Examiner failed to show that the cited reference taught 
each and every feature of independent claims 1, 14, 28, and 39. 

For a rejection to be legally adequate under 35 U.S.C. § 102, every claim feature 
must be taught in a single reference. Industries, Inc. v. Guardian Industries Corp., 75 
F.3d 1558, 1566 (Fed. Cir. 1996). The absence of any claimed feature from the reference 
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negates anticipation. Atlas Powder Co. v. E.I. du Pont de Nemours & Co., 750 F.2d 

1569, 1574 (Fed. Cir. 1984). Noehring does not teach each and every feature of 

independent claims 1, 14, 28, and 39. 

The method for retrieval of security association information in Noehring is 
significantly different than the methods recited in independent claims 1, 14, and 39. In 
Noehring, the network processor 130 performs a security policy look-up to obtain a 
security association database (SAD) entry address for a packet. (Noehring, fflj [0047], 
[0051]). The SAD entry address is prepended to the packet and sent to the pre-crypto 
packet processing system 142. (Noehring, | [0052]). The received packet is then 
assigned to a channel (i.e., a processing thread of the crypto core engine) by the pre- 
crypto packet processing system 142. (Noehring, flf [0033], [0039]). A least busy 
channel is preferably selected based on an amount of buffer space available for that 
channel in the external memory. (Noehring, 1 [0033]). The pre-crypto packet 
processing system 142 also reads a SAD entry into a local buffer using the SAD entry 
address prepended to the packet. (Noehring, 1 [0053]). The SAD entry is then verified 
by comparing the SAD entry address prepended to the data packet with valid SAD 
addresses. (Noehring, If [0054]). As described in Noehring, each received packet is 
directly associated with a specific SAD entry. 

In contrast, Applicants' claimed invention classifies each packet into an 
established flow and then associates the packet with security association information 
associated with the flow. Applicants' independent claims 1 and 14 recite: 

receiving a security association handle for each packet in the 
plurality of packets, wherein the security association handle 
includes a set of selectors; 

for each packet, identifying a flow entry for the packet, 
including: 
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determining a flow element address for the packet, 
retrieving a first flow element using the flow element 

address, wherein the first flow element includes a plurality of flow 

entries, 

determining whether a selector in the set of security 
association handle selectors is present in one of the plurality of flow 
entries, and 

retrieving a second flow element if a selector in the set 
of security association handle selectors is not present in one of the 
plurality of flow entries; 

retrieving security association information for each packet 
using the identified flow entry 

Applicants* independent claim 39 recites: 

receiving a security association handle for a packet, wherein the 
security association handle includes a set of selectors; 
determining a flow element address for the packet, 

retrieving a first flow element using the flow element address, 
wherein the first flow element includes a plurality of flow entries, 

identifying a flow entry having a selector matching a selector in 
the set of security association handle selectors; 

retrieving security association information for each packet using the 
identified flow entry 

Noehring does not first classify a received packet into an established flow and then 
associate the packet with security association information associated with the flow. As 
discussed above, Noehring assigns a packet to a channel. However, Noehring does not 
teach or suggest that a channel is associated with a flow. Furthermore, the channel in 
Noehring is assigned after the SAD entry address is determined for a packet. 
Accordingly, Noehring does not teach or suggest each and every feature of independent 
claims 1, 14, and 39. 

In Noehring, the network processor 130 performs a security policy look-up to 
obtain a SAD entry address for a packet. (Noehring, Iflf [0047], [0051]). Thus, the 
network processor 130 in Noehring directly associates a packet with a SAD entry 
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address. Accordingly, Noehring does not teach or suggest a cryptographic processing 
module including: 



as recited in Applicants' independent claim 28. 

Based on the above, Applicants respectfully request that the rejection of 
independent claims 1, 14, 28, and 39 as anticipated by Noehring be reconsidered and 
withdrawn. Accordingly, Applicants respectfully request the rejection of dependent 
claims 2-4, 6, 15-17, 19, 29, 32-38, and 40-42 be withdrawn as well. 

The U.S. Patent and Trademark Office is hereby authorized to charge any fee 
deficiency, or credit any overpayment, to our Deposit Account No. 19-0036. 



a policy lookup unit configured to identify a flow associated with 
each of the received plurality of packets and to retrieve a security 
association for each identified flow; 
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